General

  • Target

    4016495b8ea2d1dbf6bd39a27bbd969c25c72acaf9f2657277032ec24aee30d2.exe

  • Size

    1.8MB

  • Sample

    241120-c2aq8sylgt

  • MD5

    0861dddd246d33bbfd80f149ba2e4f61

  • SHA1

    b0c5997d2ac56319b9d11a9b951dc667e03f67b1

  • SHA256

    4016495b8ea2d1dbf6bd39a27bbd969c25c72acaf9f2657277032ec24aee30d2

  • SHA512

    5a7f1aad2e71a49d00a89c8e9be6036a63893a0ec843c02ac07520a27e33be2bbaf4af937e7f701d63ec7284d7413685cd44f6d835ebb2038bda2acf5f8934c4

  • SSDEEP

    49152:LNv33XL/oMmJb5rwESzjmrKTwcUoL7JD8AAoQLteiXA:herwESzjeHcUspDAbRY

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Targets

    • Target

      4016495b8ea2d1dbf6bd39a27bbd969c25c72acaf9f2657277032ec24aee30d2.exe

    • Size

      1.8MB

    • MD5

      0861dddd246d33bbfd80f149ba2e4f61

    • SHA1

      b0c5997d2ac56319b9d11a9b951dc667e03f67b1

    • SHA256

      4016495b8ea2d1dbf6bd39a27bbd969c25c72acaf9f2657277032ec24aee30d2

    • SHA512

      5a7f1aad2e71a49d00a89c8e9be6036a63893a0ec843c02ac07520a27e33be2bbaf4af937e7f701d63ec7284d7413685cd44f6d835ebb2038bda2acf5f8934c4

    • SSDEEP

      49152:LNv33XL/oMmJb5rwESzjmrKTwcUoL7JD8AAoQLteiXA:herwESzjeHcUspDAbRY

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • CryptBot

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Cryptbot family

    • Detects CryptBot payload

      CryptBot is a C++ stealer distributed widely in bundle with other software.

    • Modifies Windows Defender Real-time Protection settings

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Uses browser remote debugging

      Can be used control the browser and steal sensitive information such as credentials and session cookies.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks